GDPR and your data rights

Who is responsible for your data

Expensorr is the data controller for the account and app data you create when you use the Expensorr mobile app and website. You can reach us about any data question at bitfumes@gmail.com.

When we use hosting, AI processing, push notification, analytics, crash reporting and subscription providers to run the service, those providers act as processors on our instructions.

Why we process your data (legal bases)

Contract: to create your account, sync your transactions, wallets, budgets, labels and splits, run receipt scanning and voice capture, and manage subscriptions you buy.

Legitimate interests: to keep the service secure, prevent abuse of AI capture quotas, diagnose crashes, and improve how the product works.

Legal obligation: to keep records we are required to keep, for example around payments and tax, and to respond to lawful requests.

Consent: for optional notifications and any optional feature that asks you first. You can withdraw consent at any time in the app or your device settings.

What we process

Account data such as your name, email address, login provider details, profile settings and subscription status.

Financial tracking data you enter: transactions, income, expenses, categories, labels, wallets, budgets, currencies, splits, settlement status, notes and attached receipts or documents.

AI input data when you use receipt scanning, document parsing or voice capture: images, PDFs, audio, extracted text and the transaction suggestions generated from them.

Device and diagnostic data such as app version, device type, push notification tokens, crash reports, basic analytics and security logs.

Your rights

Access: ask for a copy of the personal data we hold about you.

Rectification: correct data that is wrong or incomplete. Most records can be edited directly in the app.

Erasure: delete your account and associated app data. You can do this yourself in the app under Settings, then Danger Zone, then Delete Account.

Restriction: ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.

Portability: receive the data you provided in a structured, commonly used, machine-readable format, or ask us to send it to another controller where technically feasible.

Objection: object to processing based on our legitimate interests, including any profiling connected to it.

Automated decisions: Expensorr does not make decisions producing legal or similarly significant effects about you by automated means. AI receipt and voice extraction only suggests values that you review and approve before anything is saved.

How to make a request

Email bitfumes@gmail.com from the address linked to your Expensorr account and tell us which right you want to exercise. We may ask for information to confirm it is really your account.

We respond within one month of receiving your request. If the request is complex or you have made several requests, we may extend by up to two further months and will tell you why within the first month.

Exercising your rights is free. We may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain our reasoning if that happens.

International transfers

Expensorr uses hosting and AI providers that may process data outside your country, including outside the European Economic Area and the United Kingdom.

Where that happens, transfers rely on an adequacy decision or on Standard Contractual Clauses with the provider, together with technical measures such as encryption in transit.

How long we keep data

Account and app data is kept while your account is active so the service can work.

When you delete your account, it is deleted and associated app data is scheduled for removal according to our operational backup and security practices. Limited records may be retained where the law requires it, for example payment records, or to prevent fraud and abuse.

Complaints

If you think we have handled your data badly, tell us first at bitfumes@gmail.com so we can try to fix it.

You also have the right to complain to the data protection authority in the EU or UK country where you live, work, or where the issue happened.